Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Is the following one a valid capture filter for VLAN 2001 traffic

It's valid, but vlan and ether[14:2]&0x0fff=2001 is exactly the same as vlan 2001 ("exactly" as in "generates exactly the same BPF machine code"), at least with recent versions of libpcap.

vlan and (ether[14:2]&0x0fff=2001 or ether[14:2]&0x0fff=2002) will test for VLANs 2001 or 2002.